For about five months, a fake cell tower rode around Toronto in the back of a car.
Phones within range connected to it automatically, because it broadcast a stronger signal than the real thing. Once attached, they received texts that appeared to come from banks and government agencies, with links to pages built to harvest logins. Toronto police say tens of thousands of devices connected to it before three men were arrested this spring on 44 charges, in what authorities called Canada’s first SMS-blaster case.
No zero-day was involved. No nation-state. Just hardware that can be bought online.
The technical bar to attack a network is falling. But too many defenders are still tripping over the fundamentals.
“Telecoms security isn’t what it used to be,” Samantha Kight, head of industry security at the GSMA, the trade body for mobile operators, told TechInformed. “It now impacts a wide range of industries, fintech, manufacturing and more. What was once mainly relevant to telecom operators now applies to any business that relies on connectivity.”
Kight spoke with TechInformed shortly after the launch of the GSMA’s eighth annual Mobile Telecommunications Security Landscape report, published in February 2026. It identifies six areas demanding attention: software vulnerabilities, democratized attacks, pre-positioning, weak cyber hygiene, supply chain failures and scams.
Anyone can attack
One of the February report’s headlines is about what GSMA calls the “democratization of attacks,” or the steady erosion of the technical expertise required to launch a damaging cyberattack. Half a year later, that erosion has only accelerated.
As of October 2026, Virgin Media O2 has blocked more than 1.4 billion scam text messages, up from 1 billion at the start of the year, and now publishes a quarterly scam index tracking threats to its customers.
The cheapest tier of attack consists of devices like the SMS blaster: a portable fake base station that pushes smishing (SMS phishing) texts directly to nearby handsets, bypassing the SMS firewalls operators use to filter messages traveling over their own networks. In addition to the Toronto seizure, police in Vienna pulled another from a car trunk in May, and this month police arrested a man running one in Cambodia.
For attackers with a monthly budget available to underwrite their nefarious activities, dark web marketplaces offer ransomware, phishing and malware as subscription services, much like legitimate software as a service. Barracuda’s 2026 Email Threats Report found that 90% of high-volume phishing campaigns now run on phishing-as-a-service kits.
Add AI, which the GSMA report noted is an accelerant for reconnaissance, vulnerability scanning and phishing message generation — tasks that once required significant human expertise. Last week, CrowdStrike estimated “over the next 12 months, some low-skill threat actors will likely use agentic AI to conduct campaigns at a level of effectiveness and scale previously only achievable by organized criminal groups or state-nexus actors.”
“AI has increased the volume of threats by lowering the skill barrier,” Kight said. “More actors can now launch attacks. However, AI has also improved defense capabilities. Security teams can detect and respond to threats more effectively, using automation and intelligence from previous incidents.”
The ghost in the network
Not every attacker is in a hurry.
In an interview with TechInformed in January, Eric Prosser, a former Air Force pilot whose startup helps enterprises inventory their cryptography, described the strategy the cybersecurity industry calls “hack now, decrypt later”: adversaries collecting encrypted traffic today and stockpiling it against the day a quantum computer can open it.
“If you’re a CISO and you’re focused on timing, you’re focused on the wrong problem,” Prosser said. “Your data is already vulnerable today. It’s how quickly you’re going to be able to cover down for it so that you can reduce your exposure in the future.”
Earlier this month, the Government Accountability Office reported that US agencies are lagging on the move to quantum-safe encryption, noting that US intelligence officials believe China is likely building a vast trove of stolen American data for exactly that purpose.
The GSMA report urges operators not to wait before auditing which cryptographic algorithms exist within their systems. A sufficiently powerful quantum computer could break the public-key infrastructure underpinning much of today’s internet security.
“They should start now, ideally yesterday,” Kight said in March.
Pre-positioning — establishing a hidden foothold within a network, sometimes for months or years, conducting low-level data theft and periodically “beaconing” to remote command servers while waiting to strike — is particularly associated with nation-state actors.
Kight said the countermeasure is proactive threat hunting: actively scanning networks for anomalies rather than waiting for an alert.
Threat hunters search for signs of lateral movement through the network, monitoring for unusual traffic flows and account activity, and implementing secure boot capabilities with regular system reboots.
“It’s similar to keeping your personal device updated, just at a much larger scale,” she said.
Back to basics
Even as organizations grapple with sophisticated threats, many are still failing at the fundamentals.
“Organizations often focus on major threats and miss foundational steps like patching, standards alignment and routine controls,” Kight said. “Despite increasingly complex environments, basic security practices are still being overlooked.”
The past few months have supplied a fresh example for nearly every item on the fundamentals checklist. As just one example: Canadian telecom provider Telus told customers in September that attackers had used stolen credentials to sit inside consumer accounts from February 2025 to June 2026 — 16 months — pulling names, billing addresses and partial card numbers.
The scam economy
Alongside technical network attacks, AI-powered scams targeting ordinary consumers have exploded. Voice phishing, where callers impersonate banks, government agencies or family members, is becoming increasingly convincing as generative AI tools improve.
“Even tech-savvy people can fall victim, especially if they’re tired or distracted,” Kight said. “In the future, the majority of scams will likely involve generative AI.”
The industry is developing countermeasures, including AI tools that deliberately waste scammers’ time, call-screening apps that flag likely fraud attempts and verified calling systems that display authenticated business identities to recipients.
Kight stressed that the burden should not fall on individuals alone.
Still, fraud at this scale has become an industry, and it is drawing an industrial response. In March, the GSMA joined more than 1,300 participants at the Global Fraud Summit hosted by the UN Office on Drugs and Crime and INTERPOL in Vienna, where governments and companies across technology, telecommunications, finance and law enforcement endorsed a Global Public-Private Partnership Framework against Fraud.
“Everyone knows someone who’s been affected by a scam,” Kight said. “It’s not just a business issue; it’s a societal one.”